netdev - Re: [PATCH v4 net-next] net: Find dst with sk's xfrm policy not ctl

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Thu, 7 Jul 2022 09:41:27 +0200
From:   Eric Dumazet <edumazet@...gle.com>
To:     Sewook Seo <ssewook@...il.com>
Cc:     Sewook Seo <sewookseo@...gle.com>,
        Linux Network Development Mailing List 
        <netdev@...r.kernel.org>, "David S . Miller" <davem@...emloft.net>,
        Hideaki YOSHIFUJI <yoshfuji@...ux-ipv6.org>,
        David Ahern <dsahern@...nel.org>,
        Jakub Kicinski <kuba@...nel.org>,
        Paolo Abeni <pabeni@...hat.com>,
        Maciej Żenczykowski <maze@...gle.com>,
        Steffen Klassert <steffen.klassert@...unet.com>,
        Sehee Lee <seheele@...gle.com>
Subject: Re: [PATCH v4 net-next] net: Find dst with sk's xfrm policy not ctl_sk

On Thu, Jul 7, 2022 at 7:41 AM Sewook Seo <ssewook@...il.com> wrote:
>
> From: sewookseo <sewookseo@...gle.com>
>
> If we set XFRM security policy by calling setsockopt with option
> IPV6_XFRM_POLICY, the policy will be stored in 'sock_policy' in 'sock'
> struct. However tcp_v6_send_response doesn't look up dst_entry with the
> actual socket but looks up with tcp control socket. This may cause a
> problem that a RST packet is sent without ESP encryption & peer's TCP
> socket can't receive it.
> This patch will make the function look up dest_entry with actual socket,
> if the socket has XFRM policy(sock_policy), so that the TCP response
> packet via this function can be encrypted, & aligned on the encrypted
> TCP socket.
>


> +++ b/net/ipv6/tcp_ipv6.c
> @@ -952,7 +952,10 @@ static void tcp_v6_send_response(const struct sock *sk, struct sk_buff *skb, u32
>          * Underlying function will use this to retrieve the network
>          * namespace
>          */
> -       dst = ip6_dst_lookup_flow(sock_net(ctl_sk), ctl_sk, &fl6, NULL);
> +       if (sk && sk->sk_state != TCP_TIME_WAIT)
> +               dst = ip6_dst_lookup_flow(net, sk, &fl6, NULL); /*sk's xfrm_policy can be referred.*/
> +       else
> +               dst = ip6_dst_lookup_flow(sock_net(ctl_sk), ctl_sk, &fl6, NULL);

Please use net instead of sock_net(ctl_sk) for consistency.

Also, if a RST is sent on behalf of a timewait socket, it will be sent
without ESP encryption.

This calls for not creating timewait sockets in the first place from
TCP established sockets
which were using XFRM.

(timewait is really best effort, I am not sure we want to extend their
size and complexity
for XFRM sake)